Linked Questions
15 questions linked to/from How to prevent email discovery in forms?
87
votes
10
answers
16k
views
New Gmail login system—going against conventional wisdom?
I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input.
Does this not go against conventional security wisdom to not ...
- 955
81
votes
10
answers
47k
views
Generic error message for wrong password or username - is this really helpful?
It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in.
One should show a generic ...
- 913
79
votes
3
answers
17k
views
Does correcting misspelled usernames create a security risk?
Does correcting a misspelled username and prompting the user with a valid username introduce a security risk?
I recently tried logging into facebook and misspelled my email. They prompted me with ...
- 865
85
votes
4
answers
46k
views
How to implement “forgot password” functionality?
For my project I need a "forgot password" functionality.
I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
- 1,067
43
votes
10
answers
15k
views
How can I securely check if a username exists?
I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username.
When the user gets to this point, I have his/her email and a cellphone number ...
- 1,091
17
votes
5
answers
14k
views
Email instead of username
I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
- 273
6
votes
7
answers
19k
views
Log in with email is more secure than a username?
Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
- 886
7
votes
4
answers
2k
views
Adding "Email or Username" in login page, is it safe?
Let's suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site.
Does that make it easy for an attacker to hack other people's account?
- 175
10
votes
4
answers
4k
views
Best practice for forgot password form, ok to leak that a given e-mail is invalid
On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid.
I ...
- 1,217
7
votes
2
answers
2k
views
Why do several bug bounties ignore user enumeration?
While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
- 5,107
4
votes
3
answers
1k
views
Is it safe to generate a password for a user during sign up in a web application?
I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
- 45
2
votes
5
answers
468
views
Can extra loading times on login attempts be a security threat?
I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password.
Since I'm using the PHP native (slow) hashing ...
- 397
0
votes
2
answers
2k
views
Is it bad if one uses the same email address on different sites/forums?
Is it bad practice if one uses the same email address on different sites and forums?
- 1
1
vote
1
answer
590
views
What are the disadvantages of logging someone in on register?
So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email?
Let's presume that ...
- 322
2
votes
1
answer
781
views
How can I design a password reset function, which does not reduce security for users who can remember their password?
We have a web app for which some users want to have a password reset function.
I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
- 5,482